shahzebjan45[.]github[.]io

PhishDestroy identifies shahzebjan45.github.io as a live, elevated-risk phishing asset currently leveraging GitHub Pages to host fake login prompts. The domain masquerades as a legitimate service to harvest user credentials, making it a direct threat to authentication integrity. Based on telemetry, this site triggers 17 out of 95 security vendors, confirming its malicious classification. It resolves to AS208475 via IP 185.199.108.153 and operates under a Let’s Encrypt SSL certificate. Registered through GitHub, Inc., the page exploits trust in the GitHub domain while hosting deceptive content. Despite its innocuous appearance, the combination of flagged detections and live status underscores its elevated risk to end users seeking to authenticate online.

Technical indicators reveal a lightweight footprint: the domain lacks historical depth, pointing to a recently deployed lure. The SSL certificate, issued by Let’s Encrypt, enhances the page’s credibility by disguising malicious intent under a green padlock. Network analysis routes traffic through Fastly’s infrastructure (AS208475) – a legitimate CDN commonly abused to host short-lived phishing pages. With 17 vendors flagging it and no presence on major blocklists at time of detection, shahzebjan45.github.io represents a stealthy, evasive threat. The absence of long-term registration details suggests a disposable asset, rapidly deployed for credential harvesting campaigns across multiple verticals.

Mitigation requires immediate network and user-level actions. Block the domain and its resolving IP (185.199.108.153) at perimeter defenses using DNS sinkholing and firewall rules. Flag any outbound traffic to this domain for investigation due to its confirmed malicious intent. Since it hosts a fake login portal, enforce multi-factor authentication (MFA) to reduce the impact of potential credential theft. Warn users to verify URLs via hover-over checks and avoid entering credentials on untrusted sites, especially those hosted on free domains like GitHub Pages. For SOC teams, ingest this IOC into SIEM dashboards and update threat intelligence feeds to preempt similar lures. Act now to prevent credential compromise and data exfiltration.